Today, it is almost a truism to say that not-for-profit organizations (NPOs) need strong governance and control. Gone are the days when various levels of government could be relied on to fund a substantial part of the operating budget, when corporate and personal donations were often a matter of straightforward philanthropy and when the “customers” for services were certain to be there. Today the NPO has to work hard to prove that it is fiscally stable and responsible and deserves support as an institution of value to its community.
The best possible weapon against this challenging external environment is an effective internal environment. There is currently great interest in governance and control as vital components of successful operations and a considerable material on this subject is available to management and directors. Of particular interest is the material published by the Criteria of Control Board (COCO) of the Canadian Institute of Chartered Accountants (CICA), which recently issued its first and second guidance releases: Guidance on Control (COCO I) and Guidance for Directors- Governance Processes for Control (COCO 2). While COCO’s primary application in practice is to public, profit-oriented enterprises, the material is designed to be equally useful for NPOs, and in this article we discuss the main features of the COCO releases (in particular those contained in COCO 2) from that perspective.
For background, COCO defines “control” as comprising:
…those elements of an organization (including its resources, systems, processes, culture, structure and tasks) that, taken together, support people in the achievement of the organization’s objectives. 1
Until the establishment of COCO, the CICA’s interest in the subject had been focused on specific policies and procedures established and maintained by management, mainly in the context of an audit of financial statements. An example of the difference in scope is COCO’s interest in monitoring an organization’s “ethical values”-an aspect of an organization that would not be very susceptible to being approached through traditional audit techniques.
The relative fluidity of COCO’s notion of control comes through in the following five concepts which are highlighted in COCO 1:2
(a) Control is effected by people throughout the organization, including the board of directors (or its equivalent), management and all other staff;
(b) People who are accountable for achieving objectives, as individuals or teams, should also be accountable for the effectiveness of control that supports achievement of those objectives;
(c) Organizations are constantly interacting and adapting;
(d) Control can be expected to provide only reasonable assurance, not absolute assurance;
(e) Effective control demands that a balance be maintained:
(i) Between autonomy and integration;
(ii) Between the status quo and adapting to change.
Of these items, (c) and (e) are perhaps the hardest to grapple with in practice and provide the basis for the most challenging portions of the COCO material. Controls over accounting systems may require only periodic overhauls, but an effective application of the COCO concept of control would encompass a response to virtually every significant issue-and maybe many of the insignificant ones-that arise within an organization. In other words, the COCO concept of control is presented as a dynamic structure for risk management.
The COCO releases generally assume that an organization will be governed by a board that accepts full responsibility for stewardship of the organization in the sense described by the recent Report of the Toronto Stock Exchange Committee on Corporate Governance in Canada (the TSE Report):
…to oversee the conduct of the business and to supervise management which is responsible for the day-to-day conduct of the business, (and to) function as the catch-all to ensure no issue affecting the business and affairs of the (organization) “falls between the cracks”.3
This description may not strike a chord with all NPOs. NPO boards vary widely in the extent to which they are actively involved in-rather than supervisingthe management of the organizations. Financial realities and resourc·e limitations may dictate that the board, usually volunteer in nature, assumes certain key management functions, such as financial management, and its members will almost invariably be involved in functions such as fund ratsmg and communication. While boards of some NPOs may be differently defined (for example, they may be mainly for advisory purposes) such different models do not make control and governance issues any less relevant; they only mean that the NPO should have some alternative structure for addressing them.
COCO 2 outlines and discusses six key control responsibilities relating to the board’s stewardship, as summarized in the following table:4
Let’s look at each of these control responsibilities in the NPO context.
Approving and monitoring mission, vision and strategy deals with the board’s role in endeavouring to see that the organization has the right approach to add to shareholder and/or stakeholder value, and improve its chances of viability and success.
Approving and monitoring the organization’s ethical values deals with the board’s role as guardian of the organization’s values, as its conscience.
Monitoring management control deals with the board’s overview of the systems whereby the chief executive officer and senior management exercise their power and influence over the rest of the organization.
Evaluating senior management deals with the board’s evaluation of the competence and integrity of the chief executive officer and other members of senior management, as it is primarily through them that the board exercises its power and influence.
Overseeing external communications deals with the board’s responsibility with respect to the organization’s communication of information to and from external parties.
Assessing the board’s effectiveness deals with how the board assesses how well it discharges its roles and the organization’s overall control.
Approving and monitoring mission, vision and strategy
COCO defines an organization’s “mission” as its reason for extstmg; its “vision” as the desired future to which it aspires, and its “strategy” as an expression of how it intends to realize that future. In a narrow sense, the mission and vision of an NPO will have been defined in its originating charter and objectives, or even in governing statutes. However with the passage of time, the NPO often needs to refocus its aims and objectives in response to sociological or demographic shifts or to funding or other pressures, regardless of the words in its original charter.
Apart, then, from regularly reviewing the organization’s strategy, the board should periodically step back, look at the bigger picture, and redefine its strategic objectives as necessary. This requires that the board be able to analyze and understand all aspects of the environment in which the NPO operates, in particular the interests and concerns of its key stakeholders.
In some cases, the stakeholders are demanding action. Numerous government agencies, boards and commissions are being required to examine their purpose rigorously and to devise business plans to justify their ongoing funding requirements, under threat of curtailment if not discontinuance of their activities. Similar re-examinations are under way in the health care industry, where the traditional “ownership” of care programs by NPOs is now being challenged, with government encouragement, by profit-driven newcomers.
Strategic re-evaluation is also illustrated by some, but not all, of our community orchestras. While some became moribund and disheartened by funding cutbacks and dwindling audiences, others successfully took their talents to the shopping malls, parks and other community sites, expanded their repertoires into pop concerts and other turns, and adopted flexible scheduling.
It is seen then that “mission” and “vision” stand, not for abstract concepts of questionable day-to-day relevance, but for the collective resources that provide an organization with its optimum balance between strength of purpose and farsighted responsiveness. It is vital that the board have a clear understanding-whether it is setting the strategy for the organization or reviewing the strategy prepared by management-of how the strategy relates to the mission and vision. Issues addressed as part of this process might include the development of the strategy and its underlying assumptions, its responsiveness to the major risks and opportunities facing the organization, and the extent of opposition to the strategy within management.
Approving and monitoring the organization’s ethical values
However self-evidently valuable an NPOs mission and vision may be, specific attention has to be devoted to maintaining an ethical internal culture. Some instances of unethical behaviour reported by NPOs over the years would have happened whatever the internal culture, but others may reflect a confusion over the appropriate response to certain “fuzzy” situations. COCO notes that even an apparently inconsequential breach of ethical values, particularly if left unpunished, may send the wrong message and thus plant the seed for more serious breaches in future.
COCOs approach to ethical values is based primarily on compliance measures and on an individual director’s “sense of what is right”. We note that codes of conduct and the example set by boards and senior management, although crucial, should be supplemented by attention to the internal day-to-day environment, in such respects as the degree of empowerment granted to individual ——– ———- –
employees. The main point though is that no NPO can afford even the perception that “wrongdoing” has gone unchallenged and the board must ensure that this message is seen and understood by all stakeholders.
Monitoring management control
When the board is more of a “governing” rather than a “managing” or “advising” body, it depends on management for its assurance that the vast majority of the organization’s control processes are operating correctly. COCO provides numerous sample questions the board should ask in assessing management’s performance in this respect. The interests of an NPO in this area should not differ significantly from those of a commercial organization except to the extent that the NPO is subject to distinct underlying risks. Whether they relate to possible loss of key volunteers or funding sources, to budgetary squeezes or other issues, management should have established a process both to identify emerging risks and to minimize them. In this respect an effective system of management control, like so many other aspects of an NPO’s operations, depends directly on the effective identification of the organization’s mission and vision.
Evaluating senior management
When the board follows a “governing” role, its main channel to senior management (and the focus of COCO’s discussion of this area) comes through the CEO or Executive Director (ED). The board defines the ED’s responsibility, sets limits to his or her authority, and should be active in monitoring performance vis a vis agreed objectives. Again, it is the function that is important rather than the title. The assessment process should be tailored to the actual allocation of responsibility within the organization. Even if the board’s role is mainly to advise, and the organization is driven by a strong ED, it will leave a major risk-management “hole” if there is no process for the ED to receive honest, balanced feedback.
Regardless of its opinion of the ED’s performance to date, the board should take a forward-looking view of his or her skills and competencies. Whatever the ED’s record of achievements, skills acquired in one environment may not translate into another.
Overseeing external communications
As already noted, in a competitive environment, the quality of an NPO’s communications with its external stakeholders may be critical to its continued wellbeing. For example, the quality of the information provided to its “customers”, key donors, and volunteers may be one of the most important aspects of ensuring their continued support. This aspect of external communications receives relatively less emphasis in the COCO discussion, which is focused primarily on formal externally mandated accountability reports. The most pervasive form of external communication-advertising-is not addressed by COCO in terms of directors’ responsibilities, other than to note that directors should be concerned that voluntary disclosures comply with the law. For many NPOs, accountability and advertising are heavily symbiotic and should be addressed jointly.
Communication is a two-way street and it is vital that the NPO should be aware of feedback received from its stakeholders. Cultural and charitable organizations are being forced to seek more, if not all, of their funding from their customers and the communities that they serve. Their potential donors, undoubtedly besieged by competing requests, are unlikely to support an organization that does not provide “good value” for the money donated. Grappling with this may represent a significant challenge. Compared to the tangible return received by a stakeholder in a commercial organization, the “return” obtained by the stakeholders of an NPO is often hard to measure. Nevertheless, some such measurement process is vital.
Assessing the board’s effectiveness
The board should adopt a formal process to assess its own effectiveness. This includes the structure and responsibilities of the board and of its committees, if any; the effectiveness of individual directors; the culture and chemistry in the boardroom; the effectiveness of the chair; and the preparation and conduct of meetings.
Users might wish to refer to the “Guidelines” of the TSE Report, which contained similar exhortations, for further discussions of this highly sensitive topic. Many of those Guidelines can be applied effectively within an NPO. For instance, an orientation program for new board members is a practical way of bringing new recruits up to speed on the complexities of the organization and of ensuring consistency in the board’s approach to the NPO’s mission and vision.
Conclusion
In our experience, almost all NPO “success stories” nowadays illustrate the importance of a strong and committed board, employing an effective and imaginative approach towards governance and control coupled with a keen sense of the organization’s mission and vision. Two illustrations drive home this point:
A volunteer board of a small nongovernment organization and its underpaid ED sat down a year ago to determine how they could survive without government funding which had been withdrawn. They focused on continuing only two of their nine programs and identified a potential corporate sponsor whose interests coincided with the objectives of the programs. They formulated an imaginative and bold three-year plan with specific targets and funding requirements, developed a “value proposition” to show the benefits to the potential sponsor and, after several months of perseverance, obtained an audience at—
i which their plan was successfully sold. As well as underwriting the costs, the sponsor suggested ways to expand the programs and became an active participant in their ongoing management. A focused approach towards the mission, the plan, and the demonstration of value were the critical components of success.
Even when the real heart of the organization lies with management, a strong and capable board is a vital resource. A few years ago an executive of a large NPO was fired and decided to form a similar organization. Through her personal reputation and the considerable appeal to the community of her new organization’s cause, she was able to attract a strong board and develop a significant membership base. Out of the blue came a substantial lawsuit by the former employer which, while appearing to be without substance, threatened to divert much of the new organization’s time and energy and limited funds. Her talented board came to the rescue. Over a weekend’s brainstorming session a defense fund was set up and a fund-raising plan developed. Every member was personally contacted by a director and asked for assistance. Local politicians voluntarily appeared in support at a culminating fund-raising dinner. The defense fund went “over the top” and was able to hire a notable lawyer who is confident of success.
Both boards demonstrated commitment and imagination in demanding situations that threatened the existence of their organizations. The boards may have been called on in a way that was not anticipated when their members were recruited, but that is the test of a risk-management structure.
For an NPO, the application of COCO might be streamlined into three essential elements which should be rigorously examined: a well defined mission and vision which respond dynamically to changes in the environment; a strong and active board in partnership with committed and effective management; and a system of governance and control that combines these elements into a cohesive workable structure.
1. See for example COCO 1, p. 4.
2. See COCO 1, pages 3-5.
3. See TSE Report, page 17.
4. See COCO 2, pages 2-3.
DAVID DONCASTER AND JOHN HUGHES*
Ernst & Young, Toronto
David Doncaster FCA., a senior partner with Ernst & Young, is the Director of the firm’s Governance practice and serves as a consultant on governance issues to a number of public and private corporations, government agencies and not-for-profit organizations.
John Hughes ACA (UK)., is a manager in Ernst & Young’s National Accounting Office with responsibility for a wide range of accounting-related matters as well as for specific areas relating to corporate governance and control.
